ha.ckers.org/xss.html xss

[paxnWo]

dati scroll pana la "Character Encoding Calculator"

la " HTML (with semicolons): " introduceti : & # 6 1 ; (fara spatii)

apoi click pe decode.

" & # 6 1 ; " inseamna " = "

de ce apare alert ?

[Nytro]

Folosesc asta:

function convertHexToASCII() {
  if (document.XSS.hexhtml.value != '') {
    var hexText = document.XSS.hexhtml.value;
    var testText = hexText.substring(3,hexText.length).split("");
    var resultString = '';
    var sub = '';
    for (i=0;i<testText.length;i++) {
      sub = testText[i].substring(testText[i].length-3,testText[i].length-1) 
      if  (sub.length < 2) {
        resultString += "%0" + sub;
        alert (sub, " - ", resultString);
      } else {
        resultString += "%" + sub;
      }
      document.XSS.ascii.value = unescape(resultString);
    }
  }
}